Check-Risk-WAF / Check-Risk-WAF
Check Risk WAF is an all-in-one Web Application Firewall with Anti-Bot and Anti-DDoS protection at L3, L4, and L7. Available on-premises or as SaaS, it protects web apps against OWASP Top 10 attacks, CWE vulnerabilities, botnets, and DoS/DDoS. Free and unlimited for everyone, forever for personal, non-commercial use.
rawfilejson / awesome-osint-arsenal
Curated list and one-command installer for 750+ open-source intelligence and security tools across 50 categories.
opentrap / opentrap
A free, open-source alternative to Burp Suite: an intercepting proxy and web app security testing suite with Repeater, Intruder, Collaborator and a built-in OWASP ZAP scanner. Linux, AGPL-3.0.
sherlock-project / sherlock
Hunt down social media accounts by username across social networks
Autumn-27 / ScopeSentry
Distributed security asset discovery platform covering subdomain enumeration, port scanning, vulnerability scanning, and page monitoring.
soxoj / maigret
🕵️♂️ Collect a dossier on a person by username from 6K websites
KatrielMoses / MailAccess
Free email OSINT tool, 5000+ platforms, identity clustering, breach detection. No API keys required. pip install mailaccess
kaifcodec / user-scanner
🕵️♂️ (2-in-1) Email & Username OSINT suite featuring native MCP support for deep data extraction just from a single Email/Username. Analyzes 2720+ actively maintained scan vectors (210+ email / 2510+ username) for security research, investigations, and digital footprinting.
0xMarcio / pocindex
Search public CVE proof-of-concept exploits from GitHub, Nuclei, ExploitDB, Metasploit and Vulhub, with CVSS, EPSS and CISA KEV context.
OSINT-Experts-Society / Consensus-OSINT
🔎 Username, email & phone OSINT — 9,700+ lookup checks from 19 projects, with profile enrichment, bulk searches, evidence graphs and expert-reviewed updates.
wazuh / wazuh
Wazuh - The Open Source Security Platform. Unified XDR and SIEM protection for endpoints and cloud workloads.
maurosoria / dirsearch
Web path scanner
digininja / DVWA
Damn Vulnerable Web Application (DVWA)
trickest / cve
Gather and update all available and newest CVEs with their PoC.
Ullaakut / cameradar
Cameradar hacks its way into RTSP videosurveillance cameras
e-m-b-a / emba
EMBA - The firmware security analyzer
cisagov / Malcolm
Malcolm is a powerful, easily deployable network traffic analysis tool suite for full packet capture artifacts (PCAP files), Zeek logs and Suricata alerts.
0xSteph / pentest-ai-agents
Turn Claude Code into your offensive security research assistant. Specialized AI subagents for authorized penetration testing plan engagements, analyze recon, research exploits, build detections, audit STIGs, and write reports.
wgpsec / AboutSecurity
Everything for pentest. | 渗透测试知识库，以 AI Agent 可执行的格式沉淀安全方法论。
Zyrexnn / Cybermes
Autonomous Offensive Security, Bug Bounty & Red Teaming Agent Framework powered by Hermes Agent, specialized reasoning skills, and multi-model LLM orchestration.
AnonCatalyst / Ominis-OSINT
This Python application is an OSINT (Open Source Intelligence) tool called "Ominis OSINT - Web Hunter." It performs online information gathering by querying Google for search results related to a user-inputted query. The tool extracts relevant information such as titles, URLs, and potential mentions of the query in the results.
nmatt0 / moria
IoT firmware identification and extraction
drduh / macOS-Security-and-Privacy-Guide
Community guide to securing and improving privacy on macOS.
ffuf / ffuf
Fast web fuzzer written in Go
yogeshojha / rengine
reNgine is an automated reconnaissance framework for web applications with a focus on highly configurable streamlined recon process via Engines, recon data correlation and organization, continuous monitoring, backed by a database, and simple yet intuitive User Interface. reNgine makes it easy for penetration testers to gather reconnaissance with minimal configuration and with the help of reNgine's correlation, it just makes recon effortless.
infobyte / faraday
Open-source and AI-powered cybersecurity tools for offensive security, vulnerability management, and autonomous pentesting. Built by hackers in Latin America, used worldwide.
ihebski / DefaultCreds-cheat-sheet
One place for all the default credentials to assist the Blue/Red teamers identifying devices with default password 🛡️
decalage2 / awesome-security-hardening
A collection of awesome security hardening guides, tools and other resources
Pennyw0rth / NetExec
The Network Execution Tool
jassics / security-study-plan
Complete Practical Study Plan to become a successful cybersecurity engineer based on roles like Pentest, AppSec, Cloud Security, DevSecOps and so on...
0xsyr0 / Awesome-Cybersecurity-Handbooks
A huge chunk of my personal notes since I started playing CTFs and working as a Red Teamer.
snooppr / snoop
Snoop — инструмент разведки на основе открытых данных (OSINT world)
edoardottt / cariddi
Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more
vulnersCom / nmap-vulners
Nmap NSE scripts that turn a service scan into CVEs, CVSS scores and known exploits — fingerprints software from HTTP responses and checks every detected CPE against the Vulners database.
lirantal / awesome-nodejs-security
Awesome Node.js Security resources
Roave / SecurityAdvisories
:closed_lock_with_key: Security advisories as a simple composer exclusion list, updated daily
pwndoc / pwndoc
Pentest Report Generator
opencve / opencve
Vulnerability Intelligence Platform
Syslifters / sysreptor
A customizable and powerful penetration testing reporting platform for offensive security professionals. Simplify, customize, and automate your pentest reports with ease.
x90skysn3k / brutespray
Fast, multi-protocol credential brute-forcer. Parses Nmap, Nessus, and Nexpose output to automatically test default and custom credentials across 30+ protocols.
Idov31 / Nidhogg
Windows rootkit for Intel x64 with 25+ features, demonstrating rootkit techniques compatible with all Windows 10 and Windows 11 versions.
lkarlslund / Adalanche
Attack Graph Visualizer and Explorer (Active Directory) ...Who's *really* Domain Admin?
yogsec / Hacking-Tools
A curated list of 900+ penetration testing and ethical hacking tools.
haccer / subjack
DNS Takeover tool written in Go
ainfosec / FISSURE
The RF and reverse engineering framework for everyone. Follow and ★ to show your support!
yeti-platform / yeti
Your Everyday Threat Intelligence
vulnersCom / getsploit
Search and download public exploits from the Vulners database — online, or fully offline from a local SQLite FTS5 index.
trickest / wordlists
Real-world infosec wordlists, updated regularly
Purp1eW0lf / Blue-Team-Notes
You didn't think I'd go and leave the blue team out, right?
Bert-JanP / Hunting-Queries-Detection-Rules
KQL Queries. Defender For Endpoint and Azure Sentinel Hunting and Detection Queries in KQL. Out of the box KQL queries for: Advanced Hunting, Custom Detection, Analytics Rules & Hunting Rules.
infosecB / awesome-detection-engineering
Detection Engineering is a tactical function of a cybersecurity defense program that involves the design, implementation, and operation of detective controls with the goal of proactively identifying malicious or unauthorized activity before it negatively impacts an individual or an organization.
Athena-OS / athena
Athena OS is a Arch/Nix-based distro focused on Cybersecurity. Learn, practice and enjoy with any hacking tool!
blackhillsinfosec / WifiForge
WifiForge is a tool developed by Black Hills InfoSec to help train Pentesters on different Wi-Fi attack vectors and Wireless capabilities.
pe3zx / my-infosec-awesome
My curated list of awesome links, resources and tools on infosec related topics
GamehunterKaan / AutoPWN-Suite
AutoPWN Suite is a project for scanning vulnerabilities and exploiting systems automatically.
APTRS / APTRS
Automated pentest reporting with custom templates, project tracking, customer dashboard and client management tools. Streamline your security workflows effortlessly!
Zarcolio / sitedorks
Search Google/Bing/Ecosia/DuckDuckGo/Yandex/Yahoo for a search term (dork) with a default set of websites, bug bounty programs or custom collection.
trickest / resolvers
The most exhaustive list of reliable DNS resolvers.
Ullaakut / nmap
Idiomatic nmap library for go developers
noraj / haiti
:key: Hash type identifier (CLI & lib)